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REMARKS 

Restriction has been required between on of Lhe following alleged 

inventions: 

1. Claims 1-21 and 28-29, drawn to building and creating some type of 
user profile to determine whether or not a user of the system is an 
authorized user so that the communications are comprised of 
authenticated actions. 

2. Claims 22-27, drawn to tracking user behaviors over time and based on 
frequently accessed clusters/documents to determine if some type of 
intrusion detection has occurred. 

Applicants hereby provisionally elect with traverse the alleged Invention 
1, Claims 1-21 and 28-29, for prosecution on the merits. 

The description of alleged Invention 1 above is somewhat accurate, in 
that the claimed invention is a method for detecting misuse of an authorized user, 
Applicants do not understand the use of the word "communications," where Claim 28 
talks of queries and digital data gathering results. The use of the word 
"communications" does appear to be used to justify a difference from the "accessed 
cluster/documents" described for Invention 2. Applicants respectfully assert that 
correctly describing and understanding the claimed invention renders the restriction 
requirement moot, particularly as Claim 28 is generic to all other claims. Claim 28 
builds a profile from terms, phrases, and/or topics. Claims 22-27 also build profiles 
using one or more of terms, phrases, or topics. 

Applicants assert that Claims 22-27 are also drawn to the invention as 
described for Claim 1. The invention of Claims 22-27 is also a method for detecting 
misuse, i.e., the Examiner's "determin[ing] whether or not a user of the system is an 
authorized user so that the communications are comprised of authenticated actions." 
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The invention of Claims 22-27 also builds a user profile. Claim 22 specifically recites 
"building up a profile of use for the user." Claims 24 and 25 also specificaiiy recite 
a user profile. Claims 23, 26, and 27 do not specifically recite the words "user 
profile," but clearly build a profile based upon use of a user for detecting misuse by 
that user. Claims 26 and 27 recite a lexicon for the user (i.e., a profile) that is 
developed from the user's authorized activity for identifying misuse. Claim 23 uses 
clustering to profile authorized activity for a user to detect misuse. Applicants also 
direct the Examiner to dependent Claim 29, which recites both a lexicon and a cluster 
index. 

The description of Invention 2 recites 'tracking user behaviors over 
time." Applicants fail to appreciate how this is sufficiently different from "building 
and creating some type of user profile" as described for Invention 1. Also, the Office 
Action is incorrect in stating Invention 2 is drawn to "intrusion detection." The 
invention of Claims 22-27 is clearly drawn to misuse detection, as in Invention 1, and 
not "intrusion detection" as alleged. 

The Office Action states that the subcombination has a separate utility, 
but then states the alleged separate utility is "indicating abnormal use of the system 
has occurred." This is the same utility as the claims of Invention 1. All claims are 
directed to misuse detection. 

All claims were examined before generic Claim 28 was added by 
Applicants. Applicants do not appreciate why the addition of a generic claim results 
in a restriction requirement. 

For at least the above reasons, Applicants respectfully request the 
restriction requirement be withdrawn and all claims be examined on the merits. 



IIT-171 



3 



MDS/I 



Serial No.: 09/929,094 



Conclusion 



Applicants intend to be fully responsive to the Office Action. 



Applicants sincerely believe that this Patent Application is now in condition for 
allowance and, thus, respectfully request early allowance. 



Pauley Petersen & Erickson 
2800 West Higgins Road 
Suite 365 

Hoffman Estates, Illinois 60195 
(847) 490-1400 
FAX (847) 490-1403 



Respectfully submitted, 




Mark D. SwansCm 
Regis. No. 48,498 
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